<?xml version="1.0"?>
<suppressions>
    <!--
        Cppcheck
    -->

    <!--
        Otherwise, Cppcheck informs us about the checkers-report option.
    -->

    <suppress>
        <id>checkersReport</id>
    </suppress>

    <!--
        Cppcheck sometimes reports that a suppression is unmatched,
        only to report a violation when the suppresion is removed.
    -->
    <suppress>
        <id>unmatchedSuppression</id>
    </suppress>

    <!--
        Including the system headers would trigger suCGI's pre-processor
        bound checks, to the effect that the analysis would fail.
    -->
    <suppress>
        <id>missingIncludeSystem</id>
    </suppress>

    <!--
        Cppcheck correctly yet wrongly assumes that enums are
        signed integers. And suCGI is compiled with

            -Wformat=2 -Wformat-overflow=2 -Wformat-signedness -Werror

        during development at any rate.
    -->
    <suppress>
        <id>invalidPrintfArgType_uint</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        str is used by an snprintf call,
        and snprintf does accept NULL in this context.
    -->
    <suppress>
        <id>nullPointer</id>
        <fileName>tests/libutil/user.c</fileName>
        <symbolName>str</symbolName>
    </suppress>


    <!--
        MISRA C
    -->

    <!--
        Rule 2.5 advises that there should be no unused macros. However,
        Cppcheck treats include guards and feature test macros as "unused"
        and consequently reports a lot of false positives.
    -->
    <suppress>
        <id>misra-c2012-2.5</id>
    </suppress>

    <!--
        Rule 3.1 requires that comments do not contain "/*" or "//".
        However, license statements contain URLs.
    -->
    <suppress>
        <id>misra-c2012-3.1</id>
        <lineNumber>1</lineNumber>
    </suppress>

    <!--
        MISRA rule 5.6 requires that typedefs are unique. Error is defined in
        types.h and by some utilities used by the test suite, which, however,
        are separate translation units.
    -->
    <suppress>
        <id>misra-c2012-5.6</id>
        <fileName>types.h</fileName>
    </suppress>

    <!--
        MISRA rule 5.7 requires that tags are unique. Some errors are defined
        in types.h and by some utilities used by the test suite, which,
        however, are separate translation units.
    -->
    <suppress>
        <id>misra-c2012-5.6</id>
        <fileName>types.h</fileName>
    </suppress>

    <!--
        Rule 8.5 requires that external objects only be declared in a
        single file. **environ is declared env.h and some unit tests,
        which, however, are separate translation units.
    -->
    <suppress>
        <id>misra-c2012-8.5</id>
        <fileName>env.h</fileName>
    </suppress>

    <!--
        Rule 8.6 requires that identifiers with external linkage be unique
        across all files. However, Cppcheck applies this rule to `main`.
    -->
    <suppress>
        <id>misra-c2012-8.6</id>
    </suppress>

    <!--
        Rule 12.1 advises that operator precedence should be made explicit.
        But Cppcheck's interpretation of this rule is too zealous.
    -->
    <suppress>
        <id>misra-c2012-12.1</id>
    </suppress>

    <!--
        Rule 14.4 requires that the condition of an if statement is a boolean.
        However, NULL is cosidered harmful <https://ewontfix.com/11/>.
    -->
    <suppress>
        <id>misra-c2012-14.4</id>
    </suppress>

    <!--
        Rule 15.5 advises that functions should have a single point of exit.
        This is to ensure that clean-up is not skipped.
        However, none of suCGI's functions performs any clean-up.
    -->
    <suppress>
        <id>misra-c2012-15.5</id>
    </suppress>

    <!--
        Rule 16.3 requires that every switch clause be terminated by a break.
        However, suCGI is compiled with

            -Wimplicit-fallthrough=2 -Werror

        during development at any rate, and switch clauses in sucgi.c are
        often terminated by `error`, which does not return. So adding
        `break` statements would just add dead code.
    -->
    <suppress>
        <id>misra-c2012-16.3</id>
        <fileName>sucgi.c</fileName>
    </suppress>

    <!--
        Rule 16.6 requires that every switch statement has at least two
        clauses. However, Cppcheck appears to count breaks, not clauses,
        and consequently reports too many false positives.
    -->
    <suppress>
        <id>misra-c2012-16.6</id>
        <fileName>sucgi.c</fileName>
    </suppress>

    <!--
        Rule 17.1 requires that variadic arguments not be used.
        However, error is a wrapper around syslog, and cannot
        be implemented without variadic arguments.
    -->
    <suppress>
        <id>misra-c2012-17.1</id>
        <fileName>error.c</fileName>
    </suppress>

    <!--
        Rule 20.5 advises that #undef not be used. However, params.h
        needs to override the build configuration for testing.
    -->
    <suppress>
        <id>misra-c2012-20.5</id>
        <fileName>params.h</fileName>
    </suppress>

    <!--
        Rule 21.1 requires that reserved identifies not be used as macro
        names. But Cppcheck applies this rule to feature test macros.
    -->
    <suppress>
        <id>misra-c2012-21.1</id>
        <fileName>*.c</fileName>
    </suppress>

    <!-- Rule 21.6 requires that stdio.h not be used, but ... -->

    <!-- ... sucgi.c needs printf for handling -h, -C, and -V. -->
    <suppress>
        <id>misra-c2012-21.6</id>
        <fileName>sucgi.c</fileName>
    </suppress>


    <!-- Test suite -->

    <!--
        Cppcheck is adamant that 512 is smaller than PTRDIFF_MAX.
    -->
    <suppress>
        <id>noValidConfiguration</id>
        <fileName>tests/utils/para.c</fileName>
    </suppress>

    <suppress>
        <id>preprocessorErrorDirective</id>
        <fileName>tests/utils/para.c</fileName>
    </suppress>

    <!--
        Cppcheck somehow fails to find a lot of definitions.
    -->
    <suppress>
        <id>misra-config</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        Cppcheck fails to recognise that libutil.a's functions are used.
    -->
    <suppress>
    <id>unusedFunction</id>
        <fileName>tests/libutil/*</fileName>
    </suppress>

    <!--
        MISRA rule 2.4 advises that projects should not contain unsed
        tag declarations. But all tags in types.h are used.
    -->
    <suppress>
        <id>misra-c2012-2.4</id>
    <fileName>types.h</fileName>
    <symbolName>Result</symbolName>
    </suppress>

    <!--
        MISRA rule 2.7 advises that every function parameter be used.
        But this cannot always be done with signal handlers or callbacks.
        Also, the test suite is compiled with

            -Wunused-parameter -Werror

        during development at any rate.
    -->
    <suppress>
        <id>misra-c2012-2.7</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 5.5 requires that identifiers be distinct from macro names.
        However, libmock.so use macros to override identifier names.
    -->
    <suppress>
        <id>misra-c2012-5.5</id>
        <fileName>tests/libmock/*</fileName>
    </suppress>

    <!--
        MISRA rule 5.6 requires that typedefs are unique.
        But utilities are independent translation units.
    -->
    <suppress>
        <id>misra-c2012-5.6</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 5.7 requires that tag names are unique.
        But utilities are independent translation units.
    -->
    <suppress>
        <id>misra-c2012-5.7</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 5.9 advises that function and object identifiers be unique
        accross all files. However, Cppcheck applies this rule to main().
    -->
    <suppress>
        <id>misra-c2012-5.9</id>
        <fileName>tests/*.c</fileName>
    </suppress>

    <!--
        MISRA rule 7.4 requires that pointers to literals be const-qualified.
        But logname and homedir in the source files below are arrays, not
        pointers. Cppcheck conflates assignment and initialisation.
    -->
    <suppress>
        <id>misra-c2012-7.4</id>
        <fileName>tests/user_exp.c</fileName>
    </suppress>

    <!--
        MISRA rule 8.2 requires that function types be in prototype form.
        They are, but Cppcheck does not recognise function pointers.
    -->
    <suppress>
        <id>misra-c2012-8.2</id>
        <fileName>tests/libutil/dir.h</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-8.2</id>
        <fileName>tests/libutil/dir_*.c</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-8.2</id>
        <fileName>tests/libutil/path.h</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-8.2</id>
        <fileName>tests/libutil/sigs.h</fileName>
    </suppress>

    <!--
        MISRA rule 8.5 requires that external objects only be declared
        in a single file. But utilities are independent translation units.
    -->
    <suppress>
        <id>misra-c2012-8.5</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!-- Cppcheck gets confused, and understandably so, by mock-ups. -->
    <suppress>
        <id>misra-c2012-8.7</id>
        <fileName>tests/libmock/*</fileName>
    </suppress>

    <!-- libutil.a's function are intended to be used externally. -->
    <suppress>
        <id>misra-c2012-8.7</id>
        <fileName>tests/libutil/*</fileName>
    </suppress>

    <!--
        MISRA rule 10.4 requires that operands be of the same type category.
        They do. But tests/NELEMS.c uses unsyntactic macros, which Cppcheck,
        apparently, cannot parse.
    -->
    <suppress>
        <id>misra-c2012-10.4</id>
        <fileName>tests/NELEMS.c</fileName>
    </suppress>

    <!--
        MISRA rule 11.4 advises that pointers not be converted to integers,
        and vice versa. They are not, but Cppcheck, again, appears to
        be confused by function pointers.
    -->
    <suppress>
        <id>misra-c2012-11.4</id>
        <fileName>tests/libutil/dir.h</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-11.4</id>
        <fileName>tests/libutil/dir_*.c</fileName>
    </suppress>

    <!--
        MISRA rule 11.6 requires that pointers to void not be converted
        to numbers. However, Apple's DYLD_INTERPOSE macro does this.
    -->
    <suppress>
        <id>misra-c2012-11.6</id>
        <fileName>tests/libmock/*.c</fileName>
    </suppress>

    <!--
        MISRA rule 13.4 advises that the result of assignment operations
        not be used. However, some idiomatic expressions require this.
    -->
    <suppress>
        <id>misra-c2012-13.4</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 15.1 advises that goto not be used. However, goto is
        the idiomatic way to do ensure that functions have a single point
        of exit for cleanup, at least in C99. So, I use goto in the test
        suite if a function needs to perform cleanup.
    -->
    <suppress>
        <id>misra-c2012-15.1</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 16.3 requires that every switch clause be terminated by a break.
        However, this is more easily, and less noisily, checked with

            -Wimplicit-fallthrough=2 -Werror
    -->
    <suppress>
        <id>misra-c2012-16.3</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 16.6 requires that every switch statement has at least two
        clauses. However, Cppcheck appears to count breaks, not clauses,
        and consequently reports too many false positives.
    -->
    <suppress>
        <id>misra-c2012-16.6</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 17.1 requires that variables arguments not be used.
        But some callbacks would be hard to implement without them.
    -->
    <suppress>
        <id>misra-c2012-17.1</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 17.3 mandates that functions not be defined implicitly.
        This rule only applies to C90, not C99. Moreover, Cppcheck fails
        to find a lot of definitions and consequently reports too many
        false positives.
    -->
    <suppress>
        <id>misra-c2012-17.3</id>
        <fileName>priv.c</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-17.3</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 17.8 advises that function parameters not be modified.
        But chaging argc and argv using optind is idiomatic.
    -->
    <suppress>
        <id>misra-c2012-17.8</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 18.8 requires that variable-length arrays not be used.
        But tests/NELEMS cannot be implemented without them.
    -->
    <suppress>
        <id>misra-c2012-18.8</id>
        <fileName>tests/NELEMS.c</fileName>
    </suppress>

    <!--
        MISRA rule 20.7 requires that macro parameters be enclosed in 
        parentheses. But tests/NELEMS' macros are unsyntactic;
        doing so would break them.
    -->
    <suppress>
        <id>misra-c2012-20.7</id>
        <fileName>tests/NELEMS.c</fileName>
    </suppress>

    <!--
        MISRA rule 20.10 requires that # and ## not be used.
        But the macro tests cannot be implement without them.
    -->
    <suppress>
        <id>misra-c2012-20.10</id>
        <fileName>tests/ISSIGNED.c</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-20.10</id>
        <fileName>tests/NELEMS.c</fileName>
    </suppress>

    <suppress>
        <id>misra-c2012-20.10</id>
        <fileName>tests/MAXSVAL.c</fileName>
    </suppress>

    <!--
        MISRA rule 21.3 requires that dynamic memory allocation not be used.
        But some things are just too complicated without dynamic memory.
    -->
    <suppress>
        <id>misra-c2012-21.3</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 21.4 requires that setjmp.h not be used. However, tests
        use sigsetjmp and siglongjmp to catch abnormal programme termination.
        Strictly speaking, this is undefined behaviour, of course.
    -->
    <suppress>
        <id>misra-c2012-21.4</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 21.5 requires that signal.h not be used.
        But that's just unfeasible for user-space tools.
    -->
    <suppress>
        <id>misra-c2012-21.5</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 21.6 requires that stdio.h not be used.
        But that's just unfeasible for user-space tools.
    -->
    <suppress>
        <id>misra-c2012-21.6</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 21.8 requires that getenv not be used.
    -->

    <!-- The environment interface cannot be tested w/o getenv. -->
    <suppress>
        <id>misra-c2012-21.8</id>
        <fileName>tests/env*.c</fileName>
    </suppress>

    <!-- tmpdir_make must read $TMPDIR. -->
    <suppress>
        <id>misra-c2012-21.8</id>
        <fileName>tests/libutil/tmpdir_make.c</fileName>
    </suppress>

    <!-- libmock.so uses environment variables for setting up tests. -->
    <suppress>
        <id>misra-c2012-21.8</id>
        <fileName>tests/libmock/*</fileName>
    </suppress>

    <!-- priv_drop forks and must call exit to quit the child process -->.
    <suppress>
        <id>misra-c2012-21.8</id>
        <fileName>tests/priv_drop.c</fileName>
    </suppress>

    <!--
        MISRA rule 21.10 requires that time.h not be used.
        But that's just unfeasible for some utilities.
    -->
    <suppress>
        <id>misra-c2012-21.10</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 22.10 requires that errno only be read after an
        errno-setting function was called. However, Cppcheck only
        recognises functions permitted by MISRA C, and thus
        reports too many false positives.
    -->
    <suppress>
        <id>misra-c2012-22.10</id>
        <fileName>tests/*</fileName>
    </suppress>

    <!--
        MISRA rule 8.7 advises that functions not be defined with external
        linkage if they are only referenced in one translation unit.
    -->

    <!--
        CERT rule INT31 requires that integer conversions do not alter data.
        But ISSIGNED works by detecting a sign change.
    -->
    <suppress>
        <id>cert-INT31-c</id>
        <fileName>tests/ISSIGNED.c</fileName>
    </suppress>

    <!--
        CERT rule STR03 requires not to "inadvertently" truncate a string.
        But there's nothing inadverent about it in the files below.
     -->
    <suppress>
        <id>cert-STR03-C</id>
        <fileName>tests/str_split.c</fileName>
    </suppress>

    <suppress>
        <id>cert-STR03-C</id>
        <fileName>tests/user_exp.c</fileName>
    </suppress>

    <!--
        CERT rule STR05 is equivalent to MISRA C rule 7.4.
        See above for details.
    -->
    <suppress>
        <id>cert-STR05-C</id>
        <fileName>tests/user_exp.c</fileName>
    </suppress>
</suppressions>
